Dynamic monitoring and securing of factory processes, equipment and automated systems

Abstract

A system including a deep learning processor receives one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process. The processor generates expected response data and expected behavioral pattern data for the control signals. The processor receives production response data from the one or more of the factory's P/E/C systems and generates production behavioral pattern data for the production response data. The process compares at least one of: the production response data to the expected response data, and the production behavioral pattern data to the expected behavioral pattern data to detect anomalous activity. As a result of detecting anomalous activity, the processor performs one or more operations to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity.

What is claimed: 
     
       1. A manufacturing system, comprising:
 two or more process stations, wherein a first process station is logically positioned upstream of a second process station, wherein each of the first process station and the second process station is configured to perform a step of a manufacturing process; 
 a first station controller programmed to control an operation of the first process station; 
 a second station controller programmed to control an operation of the second process station; 
 a deep learning controller in communication with the two or more process stations, the first station controller, and the second station controller, wherein the deep learning controller is trained to identify anomalous activity in the manufacturing process; 
 a first signal splitter positioned between the first station controller and the first process station, the first signal splitter having a single input, a first output, and a second output, the first signal splitter configured to receive a control signal transmitted from the first station controller to the first process station, divide the control signal, and provide a first portion of the divided control signal to the deep learning controller via the first output and a second portion of the divided control signal to the first process station via the second output; and 
 a second signal splitter positioned downstream of the first process station, the second signal splitter having a second single input, a third output, and a fourth output, the second signal splitter configured to receive control values output by the first process station, divide the control values, and provide a first portion of the divided control values to the deep learning controller via the third output and a second portion of the divided control values is provided to the first station controller via the fourth output. 
 
     
     
       2. The system of  claim 1 , wherein the deep learning controller is further configured to generate expected response data and expected behavioral pattern data based on the first portion of the control signal and the first portion of the control values. 
     
     
       3. The system of  claim 2 , wherein the deep learning controller is further configured to compare the expected response data to actual response data generated during a first step of the manufacturing process. 
     
     
       4. The system of  claim 2 , wherein the deep learning controller is further configured to compare the expected behavioral pattern data to actual behavioral pattern data during a first step of the manufacturing process. 
     
     
       5. The system of  claim 1 , wherein the deep learning controller is further configured to identify that the anomalous activity is a malware attack. 
     
     
       6. The system of  claim 5 , wherein the deep learning controller is further configured to execute an alert protocol when the anomalous activity is a malware attack. 
     
     
       7. The system of  claim 6 , wherein the alert protocol is digitally shutting down the manufacturing process. 
     
     
       8. The system of  claim 6 , wherein the alert protocol is an electronic notification. 
     
     
       9. The system of  claim 6 , wherein the alert protocol is digitally adjusting setpoints associated with downstream process stations. 
     
     
       10. A manufacturing system, comprising:
 a process station configured to perform a step of a manufacturing process; 
 a station controller programmed to control an operation of the process station; 
 a deep learning controller in communication with the process station and the station controller, wherein the deep learning controller is trained to identify anomalous activity in the manufacturing process based on response data received from the station controller; 
 a first signal splitter positioned between the station controller and the process station, the first signal splitter having a single input, a first output, and a second output, the first signal splitter configured to receive a control signal transmitted from the station controller to the process station, divide the control signal, and provide a first portion of the divided control signal to the deep learning controller via the first output and a second portion of the divided control signal is provided to the process station via the second output; and 
 a second signal splitter positioned downstream of the process station, the second signal splitter having a second single input, a third output, and a fourth output, the second signal splitter configured to receive control values output by the process station, divide the control values, and provide a first portion of the divided control values to the deep learning controller via the third output and a second portion of the divided control values to the station controller via the fourth output. 
 
     
     
       11. The system of  claim 10 , wherein the deep learning controller is further configured to generate expected response data and expected behavioral pattern data based on the first portion of the control signal and the first portion of the control values. 
     
     
       12. The system of  claim 11 , wherein the deep learning controller is further configured to compare the expected response data to actual response data generated during a first step of the manufacturing process. 
     
     
       13. The system of  claim 11 , wherein the deep learning controller is further configured to compare the expected behavioral pattern data to actual behavioral pattern data during a first step of the manufacturing process. 
     
     
       14. The system of  claim 10 , wherein the deep learning controller is further configured to identify that the anomalous activity is a malware attack. 
     
     
       15. The system of  claim 14 , wherein the deep learning controller is further configured to execute an alert protocol when the anomalous activity is a malware attack. 
     
     
       16. The system of  claim 15 , wherein the alert protocol is digitally shutting down the manufacturing process. 
     
     
       17. The system of  claim 15 , wherein the alert protocol is an electronic notification. 
     
     
       18. The system of  claim 15 , wherein the alert protocol is digitally adjusting setpoints associated with downstream process stations. 
     
     
       19. A computer-implemented method in a manufacturing process comprising:
 receiving, by a deep learning controller, a first portion of a control signal from a station controller, wherein the control signal is split, by a first signal splitter having a single input, a first output, and a second output, the first signal splitter receiving the control signal from the station controller, and dividing the control signal between the first portion and a second portion, the second portion sent to a process station associated with the station controller via the first signal splitter; 
 receiving, by the deep learning controller, a first portion of control values from the process station, wherein the control values are split, by a second signal splitter having a second signal input, a third output, and a fourth output, the second signal splitter receiving the control values from the process station, and dividing the control values between the first portion of the control values and a second portion of the control values, the second portion provided to the station controller; 
 generate, by the deep learning controller, expected response data and expected behavioral pattern data based on the first portion of the control signal and the first portion of the control values; and 
 identify, by the deep learning controller, whether there is anomalous activity in the manufacturing process based on at least one of the expected response data and the expected behavioral pattern data. 
 
     
     
       20. The computer-implemented method of  claim 19 , further comprising:
 determining, by the deep learning controller, that there is anomalous activity in the manufacturing process; and 
 executing, by the deep learning controller, an alert protocol based on the determining.